The key statute regulating interception of telecommunications is the Regulation of Investigatory Powers Act 2000 (specifically, Part 1 Chapter 1),as amended by the Data Retention and Investigatory Powers Act 2014. GCHQ is exclusively responsible for large-scale interception, although a range of intelligence, policing and tax authorities may also apply to the Secretary of State (a senior government minister) for a warrant to intercept communications. These bodies receive information obtained by GCHQ from its revealed by Edward Snowden, although it may not be labelled as such.
A warrant need not specify an individual or premises if it relates to the interception of communications external to the UK (s.8(4)), which is the mechanism by which the government authorizes GCHQ to undertake broad automated searches of communications that originate or terminate outside the UK, Channel Islands and Isle of Man. This includes the transmission of data to or from servers outside the UK.
The warrants must be renewed every six months (three where they relate to preventing or detecting serious crime). This allows intelligence officials to undertake automated searches through this information looking for specific keywords. GCHQ is understood to be exclusively responsible for large-scale interception, although it undoubtedly shares information with a range of other intelligence, policing and tax authorities.
Interception must be undertaken for one of the following purposes:
- in the interests of national security;
- for the purpose of preventing or detecting serious crime;
- for the purpose of safeguarding the economic well-being of the United Kingdom;
- for the purpose, in circumstances appearing to the Secretary of State to be equivalent to those in which he would issue a warrant by virtue of paragraph (b), of giving effect to the provisions of any international mutual assistance agreement.
Postal and telecommunications service providers may intercept communications “for purposes connected with the provision or operation of that service or with the enforcement, in relation to that service, of any enactment relating to the use of postal services or telecommunications services” (RIPA s.3).
Intercepted information is expressly excluded from legal proceedings (s.17) to prevent interception methods being revealed in court. It can only be used for intelligence purposes.
In his review, David Anderson QC recommended that “the capability of the security and intelligence agencies to practise bulk collection of intercepted material and associated data should be retained (subject to rulings of the courts), but used only subject to strict additional safeguards” which included judicial authorisation by a new oversight body and clearer definitions of the purpose of interception. The report also recommended the need for “a specific interception warrant to be judicially authorised if the applicant wishes to look at the communication of a person believed to be within the UK”. [1]
[1] David Anderson Q.C., ‘A question of trust’, Report of the Investigatory Powers Review, July 2015, pp 5-6.